are now generated for new certificates. However, UUIDs and old HRNs are still used, for compatibility.